Don't worry, that's perfectly normal.

Dying Light has five DLCs that are already part of the main package. Since many people didn't read the game description well enough to know they are already included they kept asking GOG if these DLC are on GOG too and how to get them. To make things more clear and prevent the many support tickets GOG listed the DLCs as Extras. See picture.

Doing so most likely required a placeholder URL for the non-existing files. Which doesn't matter for the download page since these items can't be clicked there. Which makes sense because there is nothing to download.

But gogrepo (or any other downloader) doesn't know these URLs are just placeholders and tries to download them which leads to an error.

This should really be an FAQ for gogrepo. :-)

If you, or anyone else, decide to write one, the same issue also affects "Warhammer Chaos Gate" within "warhammer_skulls_2022_digital_goodie_pack_goodies".

I've now rolled the latest dev over to master, it's probably a good idea to update when you can but there's no real urgency, just in case there's some bugs that got missed while it was on dev,.

Oh. Sorry for mentioning it then.

I love this tool.

It is subtle, but depending on where the error comes from, there is a way to tell if it is a genuine missing link or a placeholder.

A little nictpick about gogrepoc's manifest:
game sections are a bit inconvenient to manually parse, because the various elements seem sorted alphabetically and so "title" is put at the end of the list, instead of at the beginning.
Wouldn't it be possible to move "title" to the start? Or rename the element to ".title" or something?

Also, I wish you skipped the games' changelogs or stored it separately, since it's just extra info that bloats the manifest.

I'm not sure if GOG broke something recently or what, but for the past few months I've been getting "request failed: 404 Client Error: Not Found for url: <...> .sh.xml" and "no md5 data found for" errors for pretty much all Linux (.sh) files without exception. Windows and Mac files seem to be fine.

Yeah, it started with Linux files, but has now spread to Windows too.

I can confirm that with the latest Rail Route Demo, which only had the file size in bytes to verify. This was using gogcli.exe.

Very disturbing if this is a permanent change.

I was about to buy the Talisman DLC bundle, but I am now reconsidering ... though at least with those DLC I think they are all only 5 Mb each (but lots of them), and so fairly quick to check (test) using InnoExtract.

EDIT
The last game before that I downloaded, was an update for Neverwinter Nights, and included MAC and Linux files as well as Windows ones, and they all had checksum values (main, DLC, etc). That was back on the 13th January 2024. But that game was likely not updated recently.

I don't know if this was a temporary glitch or if it is a problem of your local CDN server but the xml files work fine here.

I just finished a run with my own downloader and except for very few files (the installers of Against the Storm Demo, Monster Prom 2 and Northgard) all md5 are here.

Edit: I'm talking about Windows files, I didn't check Linux.

The exceptions you mention are games that have been updated in the last two days, which is why I was thinking it might be a new policy.

We'll have to wait and see then.

I just realized that's not the only thing that changed in the last 2 days. GOG changed their code signing certificate. They moved from an SHA1 certificate from DigiCert to an SHA256 from Sectigo. Which is a bit strange since they have been with DigiCert forever.

It appears we might, and that GOG is possibly going through some transition stage, away from the MD5 algorithm, or so it would seem. So maybe we won't have new checksum values, until Galaxy gets an update ... and or maybe they will just rely on the checking during installation of a game.

EDIT
Maybe new checksum values already exist, but with a different calling query required for our third party programs.

Did you check the latest Against the Storm 1.1.2r download? I'm not getting an xml for that one.

https is authenticated so the main thing the xml does is make it easy to check if the download was interrupted early (and as a lazy way to have some check available later). The length is available in the Galaxy API and I think it should be available as a header on the final request. It is embarrassing to still be using md5 and when updating the certificate to SHA256 they might have thought about it and decided to make some changes. Or maybe just that it didn't really make sense to have the info in a separate file.

Likely just wishful thinking but with the recent terms of service update I wonder if we could see some major website changes in the next month or so.